Privacy Policy

Nutrithy Wellness

Effective date: November 5, 2026

This policy explains how Nutrithy Wellness LLP (“Nutrithy”, “we”, “us”) handles personal data when you use our websites, WEMS (our Wellness & Engagement Management System, including the corporate portal), the Nutrithy app, our wellbeing programs and the Nutrithy Fox Nuts shop (together, the “Services”). It is written to meet India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, “DPDP law”), and to follow the EU and UK General Data Protection Regulation (GDPR) as good practice.

In short: we collect only what a feature needs, we never sell your personal data, your employer never sees who used Care or what was said, and you can ask us to show, correct or delete your data at any time.

You can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India by writing to support@nutrithywellness.com.

1. Who we are and our role

Nutrithy Wellness LLP, 2nd Floor, Express Towers, Marine Drive, Nariman Point, Mumbai, Maharashtra 400021, India, decides why and how personal data is processed for the Services we offer directly to you, such as your Nutrithy app account, Care and counselling, health checks, the Fox Nuts shop and this website. For these, we are the Data Fiduciary under DPDP law (the “controller” under GDPR).

When your employer or organisation gives us your work details (for example your name, work email, employee ID, team and location) so you can join a program, we use that data to deliver the program your organisation booked. Some of this processing happens on your organisation’s instructions; in those cases your organisation is responsible for its own use of the data, and we act as its processor. Health and Care data that you give us directly stays with us and is never handed to your employer in identifiable form (see section 5).

2. Personal data we collect

Data you give us

Identity and contact: name, email, phone number, address, and for company admins, your role, company name, GSTIN and billing details.
Account and program data: account identifiers, company, department, team, location, program or challenge participation, points, rewards, streaks, check-ins and leaderboard activity.
Profile and wellness details: profile photo, city, wellness goals, sleep, lifestyle, dietary preferences, allergies, and any health concerns, symptoms or medical history you choose to share.
Care and counselling data: intake answers, session bookings, chat messages with your provider, and self-check results (see section 4).
Content you submit: photos, videos, posts, challenge proof, comments, feedback, support requests and attachments.
Orders: delivery address, order details and payment status. Card details are handled by our payment processor; we do not store full card numbers.
Enquiries and applications: what you send through our contact, demo, support and careers forms.

Data from your device, with your permission

Location: precise location (latitude, longitude, timestamps, altitude, speed and route points) only while you run an active Thrive walk, run or ride. It can continue while the app is minimised so a route is not interrupted, and stops when you pause or finish.
Health and fitness: steps, activity, motion, sleep and related metrics from Apple Health or Android Health Connect, only after you connect them.
Device and diagnostics: device model, operating system, app version, device identifiers, time zone, push-notification token, notification preferences and crash or diagnostic data.

Data collected automatically on our websites

IP address, browser type, pages visited, referring links and campaign parameters.
Cookies and similar technologies, described in section 12.

You can manage device permissions in your phone’s settings at any time. Turning a permission off stops the related feature, and nothing else.

3. Why we use your data and on what basis

We process personal data only for a clear, specific purpose, and only as much as that purpose needs. Under DPDP law we rely on your consent, or on a legitimate use the law allows (for example data you provide voluntarily for a stated purpose, compliance with law, or a medical emergency). For people covered by GDPR, the matching legal basis is shown in brackets.

Run your account and deliver programs, Care, health checks and events (contract; consent for health data).
Process orders, payments, deliveries and invoices (contract; legal obligation for tax and accounting records).
Send service messages such as sign-in codes, booking confirmations and reminders (contract).
Track active Thrive routes to show your route, distance, pace and progress (consent).
Show your organisation anonymised totals such as participation and utilisation (legitimate interests of your organisation and of providing the service; small groups are hidden).
Keep the Services secure, prevent misuse and fix problems (legitimate interests; legal obligation).
Improve the Services using aggregated or de-identified data where possible (legitimate interests).
Marketing: newsletters, offers and advertising measurement, only with your consent. You can opt out at any time.
Meet legal obligations and respond to lawful requests from authorities (legal obligation).

We do not sell personal data. We do not use location or health data for advertising. We do not make decisions about you that have legal or similarly significant effects using solely automated processing.

4. Health, Care and counselling data

Health information, counselling records and self-check results are sensitive. We collect them only with your consent, use them only to provide the care you asked for, and protect them with extra safeguards:

Care in the Nutrithy app sits behind its own PIN on your phone.
We ask for your consent before counselling starts.
Counsellors’ clinical notes are encrypted and readable only by the counsellor who wrote them and the clinical team that needs them.
Crisis help is always reachable, even without the Care PIN.

In a medical emergency or where there is a serious risk to someone’s life or safety, we may share necessary information with emergency services or a person you have named, as the law permits.

5. What your employer can and cannot see

If you use Nutrithy through your workplace, your organisation’s administrators can see the information they need to run the program, such as who registered for an event or challenge, attendance, certificates, and team leaderboards you take part in.

Your organisation never sees whether you used Care or counselling, what was discussed, your self-check answers, or your individual health data. Reports on these show only anonymised totals, and any group smaller than five people is hidden so no one can be singled out.

We share personal data only when needed, under written contracts that require the recipient to protect it and use it only on our instructions. Categories of recipients:

Care providers: the counsellors, dietitians and clinicians who deliver the care you book.
Hosting and storage: cloud infrastructure providers that host our servers and files.
Communication services: email delivery and app push-notification providers.
Payments: our payment processor, to take payments securely.
Maps: Mapbox, to match routes and show maps when you use Thrive route features.
Program partners: trainers, labs and event partners who deliver a program you joined, receiving only what they need (for example your name for an attendance list).
Analytics and advertising: on our websites only, as described in section 12.
Your organisation: as described in section 5.
Authorities and advisers: when required by law, to protect rights and safety, or to our professional advisers under confidentiality.
Business transfers: if our business is reorganised, merged or sold, subject to this policy.

A current list of our key service providers is available on request.

7. Where your data is stored

We are based in India. Some of our service providers store or process data outside India, for example file storage hosted in Singapore and email or analytics services in other countries. We transfer personal data outside India only to countries not restricted by the Government of India under DPDP law, and with contractual safeguards. For people covered by GDPR, transfers out of the EEA or UK rely on adequacy decisions or Standard Contractual Clauses.

8. How long we keep data

We keep personal data only as long as the purpose needs, then delete or anonymise it, unless the law requires us to keep it longer.

Account and program data: while your account is active. If an account is inactive for three years, we delete it after giving you notice.
Location and route data: kept with your route history and deleted when you delete the route or your account.
Care and counselling records: for as long as professional and legal record-keeping rules require, then deleted.
Orders, invoices and payments: for the period required by tax and accounting laws.
Security logs: for at least one year, as DPDP law requires, to detect and investigate misuse.
Marketing: until you withdraw consent or opt out.
Enquiries and job applications: until the enquiry is closed or the hiring decision is made, and a reasonable time afterwards.

9. Your rights

You have the right to:

Access a summary of your personal data we process, what we do with it, and who we have shared it with.
Correct, complete or update data that is wrong or out of date.
Erase your data when it is no longer needed or you withdraw consent, unless the law requires us to keep it. In the Nutrithy app you can request account deletion from your profile.
Withdraw consent at any time (section 10).
Grievance redressal: raise a concern with us and get a response (section 15).
Nominate a person to exercise your rights if you die or become unable to do so.
If GDPR applies to you, also: data portability, restriction, and to object to processing based on legitimate interests or for direct marketing.

To use any right, email support@nutrithywellness.com from the address linked to your account. We may need to confirm your identity. We respond as soon as possible and in any case within the time the law allows (within 90 days under DPDP law, and within one month under GDPR). Using your rights is free.

If you joined through your employer, you can also contact your organisation for data it controls; we will help it respond.

Where we rely on consent, we ask for it clearly and separately for each purpose, and you can withdraw it as easily as you gave it: in app settings (for example disconnecting Apple Health or Health Connect, turning off location, or switching off notifications), through the unsubscribe link in our emails, or by writing to us. Withdrawing consent does not affect processing that already happened, but it may stop a feature from working.

11. Children

Our Services are meant for adults. We do not knowingly process personal data of anyone under 18 without verifiable consent from a parent or lawful guardian, and we never track, monitor the behaviour of, or show targeted advertising to children. Where a program includes family members under 18, we will obtain verifiable parental consent first. If you believe a child has given us data without that consent, contact us and we will delete it.

12. Cookies and similar technologies

Our websites use:

Essential cookies and storage needed for sign-in, your cart, security and remembering your cookie choice.
First-party campaign attribution: a random identifier stored in your browser that records which link or campaign brought you to our site, so we can understand enquiries. It is sent only to us, never to advertising networks.
Analytics (Google Analytics and Microsoft Clarity) to understand how the site is used.
Advertising measurement (Google Ads, Meta Pixel and LinkedIn Insight Tag) to measure campaigns.

Analytics and advertising technologies are used only with your consent, which you can give or refuse in our cookie notice and change at any time by clearing this site’s data in your browser. Our apps do not use advertising trackers.

13. Security and breaches

We use reasonable security safeguards, including encryption in transit, encryption of sensitive clinical notes at rest, access controls based on role and need, logging and monitoring, and contractual security obligations for our processors. No system is perfectly secure, so we also plan for incidents.

If a personal data breach occurs, we will inform the Data Protection Board of India and each affected person as DPDP law requires, describing what happened, the likely impact and what we are doing about it, and, where GDPR applies, the relevant supervisory authority within 72 hours.

14. If you are in the EU, EEA or UK

Where GDPR applies, we are the controller for the processing described above, the legal bases are those listed in section 3, and you have the rights in section 9. You may also complain to your local data protection authority, although we would appreciate the chance to resolve your concern first.

15. Grievances and complaints

For questions, requests or complaints about your personal data, including requests under DPDP law, contact our privacy team, who can answer on our behalf:

Privacy contact
Nutrithy Wellness LLP
2nd Floor, Express Towers, Marine Drive, Nariman Point, Mumbai, Maharashtra 400021, India
Email: support@nutrithywellness.com

We acknowledge grievances promptly and resolve them within 90 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

16. Changes to this policy

We will update this policy when our practices or the law change. We will post the new version here with a new effective date and, for material changes, tell you in the app or by email before they take effect. Where a change needs your consent, we will ask for it.

Last updated: November 5, 2026